Microsoft Offical Course 20410C_10

Editor's Notes

• #2 Presentation: 80 minutes Lab: 60 minutes After completing this module students will be able to: Secure files and folders. Protect shared files and folders by using shadow copies. Configure the Work Folders role service. Configure network printing. Required Materials To teach this module, you need the Microsoft® Office PowerPoint® file 20410C_10.pptx. Important: It is recommended that you use Office PowerPoint 2007 or a newer version to display the slides for this course. If you use PowerPoint Viewer or an older version of Office PowerPoint, all the features of the slides might not display correctly. Preparation tasks To prepare for this module: Read all of the materials for this module. Practice performing the demonstrations and the lab exercises. Work through the Module Review and Takeaways section, and determine how you will use this section to reinforce student learning and promote knowledge transfer to on-the-job performance.
• #3 Provide a brief overview of the module contents.
• #4 Briefly describe the lesson content.
• #5 This topic introduces the key concepts regarding NTFS file sharing permissions. It also touches briefly on topics that you will discuss later in this lesson (for example, permissions types and inheritance). First, identify specifically what NTFS permissions are, and how you assign them. The examples in the handbook may be useful in illustrating the basic concepts of NTFS permissions. Reinforce the precedence rules as listed in the student handbook: Explicit Deny Explicit Allow Inherited Deny Inherited Allow
• #6 Discuss why shared folders are both necessary and helpful. Explain that you can secure shared folders by assigning permissions. For example, mention that a best practice is to grant only Authenticated Users access to the share.
• #7 Explain how parent and child permissions work. Use the whiteboard to draw a directory structure and show how permissions propagate downward. Discuss how inheritance is useful to manage a large number of objects. Explain how blocking clears the permissions from an object and the result of this action. Explain how blocking and propagating to child objects can create scalable management of a large number of objects.
• #8 Describe the key aspects of effective NTFS permissions, and point students to the Effective Access tool. Relate the key points for accessing a shared folder, and discuss how shared folder and NTFS permissions apply.
• #9 Introduce access‑based enumeration as defined on the slide. Access‑based enumeration uses the permissions that are set on a shared folder to determine what files and folders are visible to the end user. Ensure that students understand that access‑based enumeration is applicable only on shared folders and only at the root of the share. Ensure students are familiar with the procedure to enable access‑based enumeration on a file share.
• #10 Introduce the offline file settings, and explain how they enable clients to maintain offline copies of files and folders that are located on a network share. Mention that offline file capabilities have been built into the Windows Server® operating system since Windows Server 2003. You may also want to mention the client compatibility list: Windows® Vista®, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012. Introduce Always Offline mode to students. Explain its primary purpose, and mention the Windows operating system versions that are compatible.
• #11 Preparation Steps You need the virtual machines 20410C‑LON‑DC1 and 20410C‑LON‑SVR1 for this demonstration; start them now. Demonstration Steps Create a shared folder Sign in to LON‑SVR1 as Adatum\Administrator with the password Pa$$w0rd. On the taskbar, click the File Explorer icon. In File Explorer, in the navigation pane, expand This PC and click Allfiles (E:). On the menu toolbar, click Home, click New folder, type Data, and then press Enter. Right‑click the Data folder, and then click Properties. In the Data Properties dialog box, click the Sharing tab, and then click Advanced Sharing. In the Advanced Sharing dialog box, select Share this folder, and then click Permissions. Assign permissions for the shared folder In the Permissions for Data dialog box, click Add. Type Authenticated Users, click Check names, and then click OK. In the Permissions for Data dialog box, click Authenticated Users, and then under Allow, select Change permission. Click OK to close the Permissions for Data dialog box. Click OK to close the Advanced Sharing dialog box. Click Close to close the Data Properties dialog box.
• #12 (Continued) Configure access‑based enumeration On the taskbar, click the Server Manager icon. In Server Manager, in the navigation pane, click File and Storage Services. On the File and Storage Services page, in the navigation pane, click Shares. You may need to refresh the view to see the Shares. In the Shares pane, right‑click Data, and then click Properties. In the Data Properties dialog box, click Settings, and then select Enable access‑based enumeration. Click OK to close the Data Properties dialog box. Close Server Manager. Configure Offline Files In File Explorer, navigate to drive E, right‑click the Data folder, and then click Properties. In the Data Properties dialog box, click the Sharing tab, click Advanced Sharing, and then click Caching. In the Offline Settings dialog box, select No files or programs from the shared folder are available offline, and then click OK. Click OK to close the Advanced Sharing dialog box. Click Close to close the Data Properties dialog box. Leave all virtual machines in their current state for the subsequent demonstration.
• #13 Provide a brief overview of the lesson content.
• #14 Describe how shadow copies are based on disk changes rather than copies of files. This is an important distinction between shadow copies and backups. Some students might be concerned about using too much disk space for shadow copies. However, this should not be a concern because you can control the amount of disk space allocated for shadow copies. Ensure that students understand why shadow copies are not a suitable replacement for backups, and are not suitable for recovering databases.
• #15 Discuss the default schedule, and whether it is suitable for students’ organizations. For most organizations, the default schedule is acceptable and provides a better ability to restore accidentally deleted or modified files than a server backup provides.
• #16 It is important the students understand the general process involved in restoring a previous version. Previous versions are accessed from the Properties dialog box of a file or folder. Administrators can do this directly on the file server, but users can also perform this over the network.
• #17 Preparation Steps You need the 20410C‑LON‑SVR1 and 20410C‑LON‑DC1 virtual machines to complete this demonstration. They should already be running after the preceding demonstration. Demonstration Steps Configure shadow copies On LON‑SVR1, on the taskbar, click the File Explorer icon. In File Explorer, right‑click Local Disk (C:), and then click Configure Shadow Copies. In the Shadow Copies dialog box, click C:\, and then click Enable. In the Enable Shadow Copies dialog box, click Yes. Click OK. Create a new file In File Explorer, browse to drive C, and then click the New folder icon on the Quick Launch toolbar. Name the new folder Data, and then press Enter. Browse to the Data folder on drive C. In the Data folder, right‑click an empty space, point to New, and then click Text Document. Name the new text document TestFile, and then press Enter. Double‑click TestFile.txt to open the document. In Notepad, type Version 1. Close Notepad, and click Save to save the changes.
• #18 (Continued) Create a shadow copy In File Explorer, right‑click Local Disk (C:), and then click Configure Shadow Copies. In the Shadow Copies dialog box, click Create Now. When the shadow copy is complete, click OK. Modify the file In File Explorer, double‑click TestFile.txt. In Notepad, type Version 2. Close Notepad, and click Save to save the changes. Restore the previous version In File Explorer, in the Data folder, right‑click TestFile.txt, and then click Restore previous versions. In the TestFile.txt Properties dialog box, on the Previous Versions tab, click the most recent file version, and then click Restore. In the Are you sure you want to restore message , click Restore. Click OK to close the success message. Click OK to close the TestFile.txt Properties dialog box. Double‑click TestFile.txt to open the document, and verify that the previous version is restored. Close all open windows. Leave all virtual machines in their current state for the subsequent demonstration.
• #20 Use the slide to explain how Work Folders work. Explain that Work Folders is similar to a redirected Documents folders or Offline Folders. But unlike Offline Folders and redirected folders, which generally require users to be on the LAN or have a virtual private network (VPN) connection in order to update the corporate server, Work Folders uses URLs over secure connections. Data can be made available to users wherever they are.
• #21 Stress that this is not a collaboration feature. Users cannot give other users access to their work folders.
• #22 Stress that this feature is currently only available to Windows Server 2012 R2 and Windows 8.1 clients. Mention that there is no capability for a server to be a client. There is no item on Control Panel on a server to configure Work Folders.
• #23 Stress that Group Policy only affects domain joined devices. For non-domain joined devices Windows Intune may be used for auto configuration.
• #24 Explain that for the purposes of this demo, a registry entry has been added to allow unsecured connections to work folders. Under normal circumstances you are required to use SSL certificates to secure the connections between the client devices and the sync share. Preparation Steps You need the 20410C‑LON‑SVR1 and 20410C‑LON‑DC1 virtual machines to complete this demonstration. They should already be running after the preceding demonstration. Start both the 20410C‑LON‑CL1 and the 20410C‑LON‑CL2 virtual machines. Demonstration Steps Install the Work Folders role service On LON‑SVR1, in Server Manager click Add roles and features. In the Add Roles and Features Wizard click Next. On the Select installation type page, click Next. On the Select destination server page click Next. On the Select server roles page expand File and Storage Services and expand File and iSCSI Services. Select Work Folders, click Add Features, and then click Next. On the Select features page click Next. On the Confirm installation selections page click Install. When the installation completes click Close. Create a sync share on a file server In Server Manager click File and Storage Services, and then click Work Folders. In the details pane click the Tasks drop-down arrow, and click New Sync Share. In the New Sync Share Wizard click Next. On the Select the server and path page ensure that LON‑SVR1 is selected, click Select by file share, and then click Next. The Data shared folder created in the previous demonstration will be used.
• #25 (Continued) On the Specify the structure for user folders page click Next. On the Enter the sync share name page type WorkFolders and click Next. On the Grant sync access to groups page click Add. In the Select User or Group dialog box, type Domain Users, click OK, and then click Next. On the Specify device policies page click Next. On the Confirm selections page, click Create, and then click Close when complete. Configure Work Folder access on a Windows 8.1 client Sign in to LON‑CL1 as Adatum\Administrator with the password Pa$$w0rd. On the Start screen click Desktop. On the taskbar, click the File Explorer icon. Navigate to C:\Labfiles\Mod10, and double-click WorkFolders.bat. This batch file adds a registry entry that allows unsecured connections to work folders. Close File Explorer. In the lower-left corner of the screen, right-click the Start button and click Control Panel. Click System and Security, and then click Work Folders. In the Work Folders dialog box, click Set up Work Folders, and then click Enter a Work Folders URL instead. On the Enter a Work Folders URL page type http://lon‑svr1.adatum.com and click Next. Normally this requires a secure connection. On the Introducing Work Folders page click Next. Select the check box to accept the policies and click Set up Work Folders. Close the Work Folders dialog box. On the taskbar click the File Explorer icon. Notice there is now a Work Folders folder under the This PC folder.
• #26 (Continued) Create a file in the work folder Double-click the Work Folders icon to open the folder. Right-click a blank space in the details and click New>Text Document and press Enter. Synchronize data on a second client computer Sign in to LON‑CL2 as Adatum\Administrator with the password Pa$$w0rd. On the Start screen click Desktop. Right-click the Start charm and click Network Connections. Right-click the Ethernet 2 adapter and click Enable. Close Network Connections. Repeat steps 4 through 13 from the Configure Work Folder access on a Windows 8.1 client task. Open the Work Folders folder and notice the file you created is available from this computer. Close all open windows. On the host computer, open Hyper‑V manager and locate 20410C‑LON‑CL2. Right‑click the virtual machine and click Revert. Leave all virtual machines in their current state for the subsequent demonstration.
• #27 Briefly describe the lesson content.
• #28 The intent of this topic is to introduce the rest of the lesson, which in subsequent topics will discuss network printing in more detail.
• #29 Introduce Enhanced Point and Print, emphasizing that is not so much an implemented feature as it is a by‑product of the new version 4 (v4) driver model. Introduce the differences between version 3 (v3) and v4 drivers, and illustrate the benefits of using v4 drivers, especially for network print devices that are hosted by a Windows Server 2012 print server.
• #30 Explain to students that, in most cases, default permission are acceptable for printers. However, some organizations might want to restrict printing to specific printers—such as printers with high consumable costs, printers that print checks, or printers that are used to print highly confidential materials (for example, in a human resources or a legal department).
• #31 Preparation Steps You need the 20410C‑LON‑SVR1 and 20410C‑LON‑DC1 virtual machines to complete this demonstration. They should already be running after the preceding demonstration. Demonstration Steps Create a shared printer On LON‑SVR1, in the lower-left corner of the screen, click the Start button In the Start box, type Devices, and then click Devices and Printers. In the Devices and Printers window, click Add a printer. In the Add Printer Wizard, on the Select a Printer page, click The printer that I want isn’t listed. Click Add a local printer or network printer with manual settings, and then click Next. Other connections options are also available in this dialog box. Click Use an existing port, ensure that LPT1: (Printer Port) is selected, and then click Next. Other ports can be created manually here, including TCP/IP, for network‑connected printers. Leave the driver choice as the default, and then click Next. Change the printer name to AllUsers, and then click Next to finish the printer installation. On the Printer Sharing page, ensure that the printer is shared, and then click Next. Click Finish to close the Add Printer Wizard.
• #32 (Continued) Create a second shared printer using the same port In the Devices and Printers window, click Add a printer. In the Add Printer Wizard, on the Select a Printer page, click The printer that I want isn’t listed. Click Add a local printer or network printer with manual settings, and then click Next. On the Choose a printer port page, click Next. This is the same port as was selected for the printer created in the previous task. On the Install the printer driver page, click Next to accept the default selection. This is the same printer driver as was used for the printer created in the previous task. On the Which version of the driver do you want to use page, click Next to reuse the same printer driver. On the Type a printer name page, in Printer name, type Executives, and then click Next. On the Printer Sharing page, click Next to share the printer with the default settings. On the You’ve successfully added Executives page, click Finish. In the Devices and Printers window, review the list of devices. Notice that only the Executives printer displays. Increase printing priority for a high priority print queue In the Devices and Printers window, right‑click Executives, point to Printer properties, and then click Executives. On the Advanced tab, in Priority, type 10, and then click OK. Now jobs that are submitted to the Executives printer have higher priority that those submitted to the AllUsers printer, and will be printed first. After you complete the demonstration, revert all the virtual machines.
• #33 Printer pooling is often overlooked. Explain to students why it is beneficial—especially if there are capacity concerns about printing. Explain how printer pooling differs from just having multiple printers, because with printer pooling, other printers are made available automatically. A user does not have to look for a printer that is not busy, and then select it before printing.
• #34 Introduce Branch Office Direct Printing and the methods for enabling it. Ensure that students understand the difference between printer pooling and Branch Office Direct Printing.
• #35 Some students may be unfamiliar with the options to deploy printers using Group Policy preferences or Group Policy Objects (GPOs) created by Print Management. Spend some extra time discussing these if students are interested.
• #36 Before the students begin the lab, read the lab scenario and display the next slide. Before each exercise, read the scenario associated with the exercise to the class. The scenarios give context to the lab and exercises, and help to facilitate the discussion at the end of the lab. Remind the students to complete the discussion questions after the last lab exercise. Exercise 1: Creating and Configuring a File Share Your manager has asked you to create a new shared folder for use by all departments. There will be a single file share with separate folders for each department. To ensure that users only see files to which they have access, you need to enable access‑based enumeration on the share. There have been problems in other branch offices with conflicts when offline files are used for shared data structures. To avoid conflicts, you need to disable Offline Files for this share. Exercise 2: Configuring Shadow Copies A. Datum Corporation stores daily backups offsite for disaster recovery. Every morning the backup from the previous night is taken offsite. To recover a file from backup requires the backup tapes to be shipped back onsite. The overall time to recover a file from backup can be a day or more. Your manager has asked you to ensure that shadow copies are enabled on the file server so you can restore recently modified or deleted files without using a backup tape. Because the data in this branch office changes frequently, you have been asked to configure a shadow copy to be created once per hour. Exercise 3: Enabling and Configuring Work Folders You must now enable and configure Work Folders to support the requirements of your users. Domain users have their own Windows 8.1 and Windows RT 8.1 tablet devices and want access to their work data from anywhere. When they return to work, they want to be able to synchronize these data files. You will use Group Policy to force the Work Folders settings to users and test the settings. Instructor Note: Explain that students will be adding a registry entry to allow unsecured connections to the work folders. This is done for the purposes of this lab exercise and would not be done in a normal production environment. Exercise 4: Creating and Configuring a Printer Pool Your manager has asked you to create a new shared printer for your branch office. However, instead of creating the shared printer on the local server in the branch office, he has asked you to create the shared printer in the head office and use Branch Office Direct Printing. This allows the printer to be managed in the head office, but prevents print jobs from traversing WAN links. To ensure high availability of this printer, you need to format it as a pooled printer. Two physical print devices of the same model have been installed in the branch office for this purpose.
• #38 Lab Review Questions Question How does implementing access‑based enumeration benefit the users of the Data shared folder in this lab? Answer With access‑based enumeration, users see only the folders for their department, which creates a more streamlined navigation experience. It also makes for a more secure network browsing experience, as users are unaware of other folders and files that exist in the directory tree to which they have not been granted access. QuestionIs there another way you could recover the file in the shadow copy exercise? What benefit do shadow copies provide in comparison? Answer Within the lab itself, the user could recover the file from the Recycle Bin. However, in a real-world scenario, if the Recycle Bin has been emptied, or if the file has been changed more than once, then the file cannot be recovered using this method. In comparison, shadow copies maintain multiple, persistent copies of modified files that can be recovered by an administrator or by an end user. Question In Exercise 3, how could you configure Branch Office Direct Printing if you were in a remote location and did not have access to the Windows Server 2012 GUI for the print server? Answer You could configure Branch Office Direct Printing by connecting remotely using Windows PowerShell® from a Windows 8 or Windows Server 2012 computer. Then, you could use the Set‑Printer cmdlet to change the configuration.
• #39 Module Review Questions Question How does inheritance affect explicitly assigned permissions on a file? Answer While inherited permissions accumulate with explicit permissions, explicitly assigned permissions always supersede inherited permissions. Question Why should you not use shadow copies as a means for data backup? Answer While shadow copies can store copies of files and protect against issues like accidental deletion, they are still reliant on the local files system and Windows Server 2012 for their functionality. Hard drive corruption, or destruction of the local machine renders shadow copies useless in a disaster recovery situation. Question In which scenarios could Branch Office Direct Printing be beneficial? Answer Branch Office Direct Printing is typically best used when the wide area network (WAN) connection between a printer and a print server is slow or unreliable. When clients are located in the same physical location as the printer, and they use Branch Office Direct Printing, time to print is decreased and network bandwidth use is reduced because print jobs are sent from the client computer directly to the printer and not to the central server and then back to the branch office printer. Tools